?FindLatestSection@@YAGPADG@Z
Static task
static1
Behavioral task
behavioral1
Sample
b7f66cca066f8d92fc5d5e190c485ce0_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b7f66cca066f8d92fc5d5e190c485ce0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7f66cca066f8d92fc5d5e190c485ce0_JaffaCakes118
-
Size
237KB
-
MD5
b7f66cca066f8d92fc5d5e190c485ce0
-
SHA1
e7f55a9e21a3f6d0a4a2b689ad37a6a94eed0f70
-
SHA256
c2b8aa577a977c597b099af636ab9d12d47c8790bcd95a9335dfed6d3a9981ec
-
SHA512
a9e2eac2ede74ce4fe4680ec97a016f6e0bf51c154cfd52662c30788440eb42893438fcde145c9c07d35daee299b495239716f3c1db7c5632bc2e175ca9f1e3b
-
SSDEEP
3072:DhvXzOWApCaoghw9WOktm+t5uImIIWHF9RMFnv+xBbllVBk6xSpTjnmgh2xhXxbL:DhvRaoghwy8Im3WHRmnvklBkMc70xbL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7f66cca066f8d92fc5d5e190c485ce0_JaffaCakes118
Files
-
b7f66cca066f8d92fc5d5e190c485ce0_JaffaCakes118.exe windows:4 windows x86 arch:x86
f684d482986e7943a7ab9b42a025a96c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteKeyA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
shell32
SHChangeNotify
kernel32
GetShortPathNameA
GetTempPathA
SetFileAttributesA
CopyFileA
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
LocalFree
InterlockedExchange
GetThreadLocale
GetLocaleInfoA
GetACP
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateMutexA
ReleaseMutex
DeleteCriticalSection
Sleep
InitializeCriticalSection
GetModuleFileNameA
GetExitCodeThread
LoadLibraryExA
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringA
lstrcpyA
lstrcatA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
CreateDirectoryA
GetLocalTime
VirtualQuery
SetUnhandledExceptionFilter
WriteFile
IsBadWritePtr
WritePrivateProfileStringA
OutputDebugStringA
GlobalMemoryStatus
QueryPerformanceCounter
GetLogicalDrives
GetPrivateProfileSectionNamesA
GetDiskFreeSpaceA
GetSystemInfo
QueryPerformanceFrequency
GetPrivateProfileIntA
lstrlenA
lstrcpynA
TerminateProcess
GetExitCodeProcess
ResetEvent
ResumeThread
CreateEventA
LocalAlloc
OpenMutexA
SetLastError
GetFileAttributesA
ReadFile
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
CreateFileA
SetStdHandle
VirtualProtect
SetFilePointer
VirtualAlloc
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
FlushFileBuffers
UnhandledExceptionFilter
CloseHandle
GetCurrentThread
GetVersionExA
GetLastError
WaitForSingleObject
CreateProcessA
FreeLibrary
GetTickCount
LoadLibraryA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
HeapReAlloc
GetOEMCP
CompareStringA
CompareStringW
GetCPInfo
GetDriveTypeA
SetEnvironmentVariableA
HeapSize
LCMapStringW
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
RtlUnwind
RaiseException
HeapDestroy
HeapCreate
VirtualFree
TlsAlloc
user32
DestroyWindow
LoadStringA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
RegisterClassA
EnumDisplaySettingsA
SystemParametersInfoA
MessageBoxA
GetDesktopWindow
ExitWindowsEx
DefWindowProcA
PostQuitMessage
KillTimer
FindWindowA
SetTimer
PostMessageA
wsprintfA
CreateWindowExA
RegisterClassExA
LoadCursorA
advapi32
RegDeleteKeyA
RegDeleteValueA
IsValidSid
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
RegEnumValueA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
StringFromGUID2
CoCreateGuid
Exports
Exports
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ